IPS file based repositories and zones

If you are using filesystem based (file://) repositories with IPS, rather than network-based ones, there is one caveat to worry about when making zones.

When a zone is created on Solaris 11, the set of repos to use is copied from the global zone. If you're using network-based repositories this is normally not a problem. There could still be an issue if you use "localhost" in your repo URLs, or the non-global zone does not have access to the network repos that the global zone does.

With filesystem-based repositories, however, the non-global zone almost certainly doesn't have access to the appropriate directories by default.

For example:

root@global# pkg publisher

PUBLISHER TYPE STATUS URI

solaris (preferred) origin online http://localhost/

boyd origin online file:/export/repo/boyd/

root@global# zoneadm -z cal install

A ZFS file system has been created for this zone.

Publisher: Using solaris (http://localhost/ ).

Publisher: Using boyd (file:/export/repo/boyd/).

[...]

root@cal:~# pkg refresh

pkg: 0/2 catalogs successfully updated:

Unable to contact valid package repository

Encountered the following error(s):

Unable to contact any configured publishers.

This is likely a network configuration problem.

[...]

2: file protocol error: code: 22 reason: The path '/export/repo/boyd' does not contain a valid package repository.

Repository URL: 'file:/export/repo/boyd'.

One way to deal with this is to loopback mount (read-only) the repo directory into the zone:

root@global# zonecfg -z cal

zonecfg:cal> add fs

zonecfg:cal:fs> set special=/export/repo/boyd

zonecfg:cal:fs> set dir=/export/repo/boyd

zonecfg:cal:fs> set type=lofs

zonecfg:cal:fs> add options ro

zonecfg:cal:fs> end

zonecfg:cal> exit

Now the zone can access the repo as it should.